fc050b436c44af7a6ac959b4dc1e0cc5.zip
- SHA256 7278ff7a9e905fb46b62f52a3835fcd9c809a923a741d246aa8b5d245988dfad
Overview
overview
3Static
static
3coinst.dll
windows10-2004-x64
3coinst.exe
windows10-2004-x64
3itdrv.dll
windows10-2004-x64
3itdrvbg.chm
windows10-2004-x64
1itdrvbp.chm
windows10-2004-x64
1itdrvcz.chm
windows10-2004-x64
1itdrvdu.dll
windows10-2004-x64
3itdrven.chm
windows10-2004-x64
1itdrvex.exe
windows10-2004-x64
3itdrvfn.chm
windows10-2004-x64
1itdrvhb.chm
windows10-2004-x64
1itdrvhu.chm
windows10-2004-x64
1itdrvlf.dll
windows10-2004-x64
3itdrvm.dll
windows10-2004-x64
3itdrvo.dll
windows10-2004-x64
3itdrvpc.dll
windows10-2004-x64
3itdrvpo.chm
windows10-2004-x64
1itdrvpp.dll
windows10-2004-x64
1itdrvro.chm
windows10-2004-x64
1itdrvru.chm
windows10-2004-x64
1itdrvsc.dll
windows10-2004-x64
3itdrvsf.dll
windows10-2004-x64
3itdrvsp.chm
windows10-2004-x64
1itdrvtk.chm
windows10-2004-x64
1itdrvu.dll
windows10-2004-x64
3itdrvu2.dll
windows10-2004-x64
3itdrvum.dll
windows10-2004-x64
3sxp3ml3.dll
windows10-2004-x64
3sxp3mu.bmp
windows10-2004-x64
1sxp3mu.ini
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
coinst.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
coinst.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
itdrv.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
itdrvbg.chm
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
itdrvbp.chm
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
itdrvcz.chm
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
itdrvdu.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
itdrven.chm
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
itdrvex.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
itdrvfn.chm
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
itdrvhb.chm
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
itdrvhu.chm
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
itdrvlf.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
itdrvm.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
itdrvo.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
itdrvpc.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
itdrvpo.chm
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
itdrvpp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
itdrvro.chm
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
itdrvru.chm
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
itdrvsc.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
itdrvsf.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
itdrvsp.chm
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
itdrvtk.chm
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
itdrvu.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
itdrvu2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
itdrvum.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
sxp3ml3.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
sxp3mu.bmp
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
sxp3mu.ini
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target fc050b436c44af7a6ac959b4dc1e0cc5.zip
- Size 2.8MB
- Sample260919-mcl33seb29
- SHA256 7278ff7a9e905fb46b62f52a3835fcd9c809a923a741d246aa8b5d245988dfad
- MD5 4e2a1a095309ee1704d628851aa64958
- SHA1 9e9ca917ef8f5cc58937434572064f6760d1ff83
- SHA512 c00306bbdc60ebe59b3c892ae579dc553697b9db6589fcd45e6d0a07787a15862f9b84d666d86ed084b823501a5e4f545d7538a851ad2a963485964315dba7e3
- SSDEEP 49152:t+VgcMjcg4EO2YPUYqWNVc4U5JjA0g1KLSnjVyL6jd+k6BhZuMktdozjNSJ1d:MVgcxlrqcVc4U5VA0ZLSnZU6jZkbzkTX
- TLSH T123D53344E7B1A49BC147FAB480A87FBFB044193D339187AD679A7F4117426C4AB2E21F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 15 IoCs
Checks for missing Authenticode signature.
resource unpack001/coinst.dll unpack001/coinst.exe unpack001/itdrv.dll unpack001/itdrvdu.dll unpack001/itdrvex.exe unpack001/itdrvlf.dll unpack001/itdrvm.dll unpack001/itdrvo.dll unpack001/itdrvpc.dll unpack001/itdrvsc.dll unpack001/itdrvsf.dll unpack001/itdrvu.dll unpack001/itdrvu2.dll unpack001/itdrvum.dll unpack001/sxp3ml3.dll
File Explorer
-
fc050b436c44af7a6ac959b4dc1e0cc5.zip.zip 2.8MB
-
coinst.dll.dll 64KB
-
coinst.exe.exe 148KB
-
itdrv.dll.dll 988KB
-
itdrvbg.chm.chm 34KB
-
itdrvbg.dat78KB
-
itdrvbp.chm.chm 34KB
-
itdrvbp.dat84KB
-
itdrvcz.chm.chm 35KB
-
itdrvcz.dat80KB
-
itdrvdu.dll.dll 400KB
-
itdrven.chm.chm 32KB
-
itdrven.dat77KB
-
itdrvex.exe.exe 52KB
-
itdrvfn.chm.chm 35KB
-
itdrvfn.dat89KB
-
itdrvhb.chm.chm 33KB
-
itdrvhb.dat73KB
-
itdrvhu.chm.chm 36KB
-
itdrvhu.dat83KB
-
itdrvlf.dll.dll 68KB
-
itdrvm.dll.dll 304KB
-
itdrvm1.bmp38KB
-
itdrvm2.bmp28KB
-
itdrvm3.bmp10KB
-
itdrvo.dll.dll 212KB
-
itdrvpc.dll.dll 19KB
-
itdrvpo.chm.chm 36KB
-
itdrvpo.dat82KB
-
itdrvpp.dll14KB
-
itdrvro.chm.chm 34KB
-
itdrvro.dat81KB
-
itdrvru.chm.chm 35KB
-
itdrvru.dat83KB
-
itdrvsc.dll.dll 520KB
-
itdrvsf.dll.dll 524KB
-
itdrvsp.chm.chm 35KB
-
itdrvsp.dat85KB
-
itdrvtk.chm.chm 34KB
-
itdrvtk.dat80KB
-
itdrvu.dll.dll 944KB
-
itdrvu2.dll.dll 1.2MB
-
itdrvul.bmp7KB
-
itdrvum.dll.dll 1008KB
-
itdrvum.xml.xml 23KB
-
itdrvuy.bmp175KB
-
sxp3m.PNF12KB
-
sxp3m.cat28KB
-
sxp3m.inf7KB
-
sxp3ml3.dll.dll 23KB
-
sxp3ml3.smt361B
-
sxp3mpp.ver375B
-
sxp3msc.cts248KB
-
sxp3mu.bmp23KB
-
sxp3mu.ini6KB
coinst.dll
- IMPHASH 2b405e6c63c53eb3a4761753f628d485
- SHA256 2761685da8225d921d931593cf2f0176922ae5067c66405599fdeb5196fcc267
- MD5 6f70e4892bf39ca40f4e8722c9ab9b3a
- SHA1 70ab825855d3ec8a755c2e57893f9c81997565e4
- SHA512 84d4543cece3d79786ac47100ed6829a9794854f1f476149a1ec6b130ce5a782c30536dc5766a8b7cba884317f13f3433ae10b24e5058c345f30651bce02ec66
- SSDEEP 768:bGGcWehIoXJ39WTWoIYP8yGgtJ7HQXylSIa5N9iYlmDDl4Kp/sIK:GJmTWoMgtJTQXZ1sl4Kp/
- TLSH T174539F11B6A2C2F7C79902B129B24F3B977DBD110BF148439F65DAEC1D715A0E23A287
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9167
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
WriteFile
Sleep
CreateProcessA
SetEndOfFile
GetModuleFileNameA
GetCurrentProcess
GetVersionExA
GetLastError
GetSystemDirectoryA
CloseHandle
RtlUnwind
RaiseException
GetCommandLineA
GetVersion
HeapFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
ExitProcess
TerminateProcess
HeapReAlloc
HeapAlloc
HeapSize
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetFilePointer
InterlockedDecrement
InterlockedIncrement
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
advapi32
GetTokenInformation
RegQueryValueExA
RegCloseKey
OpenProcessToken
setupapi
SetupDiGetDeviceInstanceIdA
SetupDiGetSelectedDriverA
SetupDiGetDriverInfoDetailA
SetupDiOpenDevRegKey
CoDeviceInstall
Name
.text
Size
32KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=14, version=7299,
count=79, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=7, id=93, version=2179,
count=89, id=1, productName=Unmarked objects,
count=13, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
coinst.exe
- IMPHASH 242e7918703fda2a620787bd5358f1cc
- SHA256 0d6315f2b49d9f669f834ceb7260d3e881528b05fc70aa83444a85d0d8ee68e2
- MD5 36089584fc093a8512f427733a798c6c
- SHA1 3060acb62b9842555e08323b6f89ff062e350025
- SHA512 ff276f2a9891a36eff73a55dbef0e73e05de609e3a8e7f06df674e6b75fed820f7a8d995dc031ebdab2261a4cd3e44954a20cb2556798619b44826486dbdd80c
- SSDEEP 3072:/RckF/viMQJpfXcujOR+3x5kvn8Uv5LU1UcvlebG:/qk1RcUujORKbqBb
- TLSH T173E38D2239D6CCF3C26502708D644F7EB3BAE8340E724587B348974D9E769E5C92F266
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32989
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
setupapi
CMP_WaitNoPendingInstallEvents
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiOpenDeviceInterfaceRegKey
kernel32
GetCurrentDirectoryA
SetFilePointer
FlushFileBuffers
GetFullPathNameA
RtlUnwind
RaiseException
GetStartupInfoA
GetCommandLineA
ExitProcess
HeapAlloc
HeapFree
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetACP
HeapSize
TerminateProcess
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetOEMCP
GetCPInfo
GlobalFlags
GetProcessVersion
lstrcatA
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetModuleHandleA
GetCurrentThreadId
GetVersion
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
GlobalLock
GlobalHandle
GlobalUnlock
TlsAlloc
LocalAlloc
GetModuleFileNameA
lstrcmpA
EnterCriticalSection
GetLastError
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
lstrcpynA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
lstrcpyA
FindFirstFileA
SetLastError
FindClose
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
LocalFree
lstrlenA
WideCharToMultiByte
GetCurrentProcess
GetVersionExA
DeviceIoControl
GetProfileStringA
GlobalAlloc
LoadLibraryA
GetProcAddress
WriteProfileStringA
FreeLibrary
GlobalFree
WriteFile
SetEndOfFile
CreateFileA
CloseHandle
GetPrivateProfileStringA
GetLogicalDriveStringsA
GetDriveTypeA
HeapReAlloc
user32
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
PostMessageA
LoadIconA
SetWindowTextA
LoadCursorA
GetSysColorBrush
ReleaseDC
GetDC
GetClassNameA
PtInRect
ClientToScreen
PostQuitMessage
DestroyMenu
TabbedTextOutA
DrawTextA
GrayStringA
CopyRect
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextA
GetDlgCtrlID
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
DispatchMessageA
GetKeyState
CallNextHookEx
PeekMessageA
SendNotifyMessageA
GetTopWindow
GetClientRect
wsprintfA
LoadStringA
EnableWindow
MessageBoxA
SendMessageA
GetWindowLongA
IsWindowEnabled
SetWindowsHookExA
UnhookWindowsHookEx
GetParent
GetLastActivePopup
gdi32
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
GetDeviceCaps
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
winspool.drv
DocumentPropertiesA
ord201
GetPrinterDataExA
EnumPrintersA
GetPrinterA
SetPrinterA
GetPrinterDriverA
ord202
OpenPrinterA
DeletePrinter
ClosePrinter
advapi32
RegOpenKeyExA
RevertToSelf
RegEnumKeyExA
RegCloseKey
OpenProcessToken
GetTokenInformation
RegQueryValueExA
ImpersonateLoggedOnUser
shell32
ShellExecuteExA
comctl32
ord17
Name
.text
Size
96KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=95, version=2190,
count=26, id=14, version=7299,
count=122, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=380, id=1, productName=Unmarked objects,
count=19, id=93, version=2179,
count=58, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
itdrv.dll
- IMPHASH 9c97f18a82a734c5be8fee5969926475
- SHA256 59b1a2acb1cb7721a99b8f07a5bbecb195348045cc52fafeaa3a34f6c970d673
- MD5 6ceada3617db385ea3169e419dfcae53
- SHA1 6449982d6b574516f79938246f9686617550b771
- SHA512 da089510bb83dde7e4787ddf3bb38344622985d307a05feae1e73c5b8dd0552bb044c3479c81c3ba289b09adac4c88ef79a893a572fdffa5156a3a4e2ebff631
- SSDEEP 12288:wO4Gltgri/HGFDXlj6/ujVSiRIbnRhh3LBa+6cToOGE2z4UO7ksDWR2:wO4GlCG/mNx6Gjtezh3LucTovt4UO/s
- TLSH T1EE258D23EBC07971D8A72570D22B363491BBF416C33966D7BB0D4AD9A831BD29E70346
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
280424
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
H:\WINDDK\3790~1.183\lib\wxp\i386\SSPCL6.pdb
msvcrt
malloc
_adjust_fdiv
_initterm
free
wcscat
sprintf
towupper
_wcsnicmp
_wcsupr
wcsstr
_snwprintf
wcsncpy
time
srand
rand
strncmp
ceil
swprintf
_wcsicmp
wcscpy
atol
_ultoa
_ltoa
qsort
longjmp
_setjmp3
strstr
wcslen
_wtoi
wcscmp
winspool.drv
GetJobW
EndDocPrinter
GetPrinterW
EndPagePrinter
OpenPrinterW
SetPrinterDataW
ClosePrinter
WritePrinter
GetPrinterDriverW
EnumPortsW
GetPrinterDataW
StartPagePrinter
StartDocPrinterW
user32
SetForegroundWindow
MessageBoxW
wsprintfW
CharUpperA
LoadStringW
GetActiveWindow
kernel32
FindResourceW
LoadResource
LockResource
IsDBCSLeadByteEx
GlobalFree
SetLastError
CloseHandle
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapFree
UnmapViewOfFile
GlobalAlloc
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpiW
GetModuleFileNameA
HeapAlloc
GetACP
LocalAlloc
GetLastError
HeapCreate
WideCharToMultiByte
GetVersion
MulDiv
GetLocalTime
lstrcmpW
DeleteFileW
FreeLibrary
OutputDebugStringW
GetLocaleInfoA
lstrlenW
SetFilePointer
ReadFile
SearchPathW
GetFileTime
LoadLibraryW
WriteFile
GetTempFileNameW
WritePrivateProfileStringW
lstrcpyW
GetSystemDirectoryW
WaitForSingleObject
GetVersionExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
DisableThreadLibraryCalls
GetLocaleInfoW
CompareFileTime
GetProcAddress
advapi32
RegQueryValueExW
GetUserNameW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
gdi32
PATHOBJ_vEnumStartClipLines
PATHOBJ_bEnumClipLines
CLIPOBJ_cEnumStart
CLIPOBJ_bEnum
FONTOBJ_pvTrueTypeFontFile
PATHOBJ_vEnumStart
PATHOBJ_bEnum
EngCheckAbort
XFORMOBJ_bApplyXform
EngComputeGlyphSet
FONTOBJ_cGetAllGlyphHandles
STROBJ_dwGetCodePage
FONTOBJ_pifi
FONTOBJ_pxoGetXform
FONTOBJ_cGetGlyphs
EngCreateBitmap
PATHOBJ_vGetBounds
EngDeletePath
STROBJ_vEnumStart
STROBJ_bEnum
XFORMOBJ_iGetXform
BRUSHOBJ_pvGetRbrush
EngCreateDeviceSurface
EngMarkBandingSurface
EngAssociateSurface
EngCreatePalette
EngDeletePalette
EngDeleteSurface
ExtEscape
TranslateCharsetInfo
XLATEOBJ_iXlate
BRUSHOBJ_pvAllocRbrush
EngStretchBlt
EngEraseSurface
EngStretchBltROP
CLIPOBJ_ppoGetPath
EngBitBlt
shell32
ShellExecuteExW
SHGetFolderPathW
DllEntryPoint
DrvCompletePDEV
DrvDisableDriver
DrvDisablePDEV
DrvDisableSurface
DrvEnableDriver
DrvEnablePDEV
DrvEnableSurface
DrvQueryDriverInfo
DrvResetPDEV
Name
.text
Size
349KB
Virtual Size
349KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
30KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
592KB
Virtual Size
592KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=166, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=92, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=120, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
itdrvbg.chm
- SHA256 1098010f3cb3ab5df734a5efa41633bcefcb37a3b2ede24b347f089a8fcbcc3e
- MD5 a7e7121d85ffba2cdb427139cacaec3e
- SHA1 0f349cbb7d637baaafff1c41758ff005650227ec
- SHA512 e4c76a951b6d17eeb778ddaf5862e8fba2c9bade09e7fa0d113699322e723deafbae34c6aa1c547ef68229462f958fa98130fe077ea9f2af5c27136175a34366
- SSDEEP 768:JzKu9hgj3IsuYWOdtrTlWOdDqObt1JDcb3yYHC:JzKu9hkIBUthOObLe3U
- TLSH T1F2F2D08E6D305130D4E84F333ED36BE46A18AD80D7F6B1243F0EA27584A6B29C5D49F9
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvbg.dat
- SHA256 1f6c254f68880c631b1a0be9d0e04f1f32cb6bfbbf301b0d144ae64ef83ffc51
- MD5 c314f3ec6a108f0b4420b7626014b51e
- SHA1 f9c31fcb945b290dc2d8c3a487885a03402b39dc
- SHA512 f6b47e05202e8a907016e5140bccec51de59170760fc3ebace5d2973360f8f56859696714c1499bc2e14fdbf0530e35136d2357fc9b91351bdec9e1eb4fd26c4
- SSDEEP 1536:2cTWbCGmc4fMADCvn+VCvg6EegU+psCOF:2cTWbCGziMADCv+VCvg6Eeg8F
- TLSH T17473B78B95370BA8D4C30EC1358B367D193AE24585D5AAF67C47B88C724C76F2A933D2
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvbp.chm
- SHA256 e55b0115ad2a6564c9bb8a0f92c01eb3aa728b6ca3dfe1700665b259af5d0af6
- MD5 f47b52420b03df0614ced7ca948c33d9
- SHA1 8c39c565d1400c69eb68c5c7475e3857d2c70657
- SHA512 420096e08317780252a46e5667fcd4fcc0fd4f8fabf446552c07c8158c4df035600a5cd4b12aa52e79ee2de6d21d02a9e9de4a2ed1956006a665adf4bdf583e6
- SSDEEP 768:X02U4EnZVs8gGA605rl7ZII8Z++DuMZUqXq12:X0CEHs8HIqpZUqXq12
- TLSH T1C5F2E04E1E305066D8A44F3A79DBA7E63101CCC0FED7F543262E9734BA9A7085B705B6
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvbp.dat
- SHA256 9ce174d11b7ce17a88794a879119aab5c8dde889c073eb6fdbd35cc57292c16e
- MD5 cc8c776b9b32a602e5349decf07348a3
- SHA1 5b5e92d37defa016fe84b08b79bf59ae9360a1bf
- SHA512 db2fdf4a056c1489f6761b3398fae0145aa430deddee2dd1ef904b9f3a8b79fb86ae4f18ad948e383e75effb7884f7bdad422840db37eaed0751bd08c1588429
- SSDEEP 1536:JNsofUpzIcFoaTyXIMacTyXIMB5CfoRA/AlpK:JHeIcF/TyXIMacTyXIMBBlpK
- TLSH T12D83B52F95EA0751C8D30FC1718BB27F5676C1666597CD73344EA08CB18C7AA9B223E2
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvcz.chm
- SHA256 5998b7a592d2614d624a1b4ab066b294cebbe83d2d86ee68fd670140acba115d
- MD5 03964a10a132c088d023a8fcb71340c4
- SHA1 ff34b767eb7cab66c13989f9d585ce48ae3cbdef
- SHA512 fd2a0200a436a2dda1b8e23e81bae921fad83a3e2e26ba52e1b485d3fbc3c7a6906c014d9c2dc1e878977a3e51a63992c49cc772d8bfcb019eb32aca6258f2d7
- SSDEEP 768:2nxKMHnhZ9b2aYU9sKMFrwO51KLDQbhplSKBg2NnkA15oS:2x1H/9b2ktM+ObmEb9I2NnkzS
- TLSH T18DF2D0482E044335FB615F376EC3AF89A6369841F109B5861C7EB73840E3B19B6582B3
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvcz.dat
- SHA256 d9aa4180ad3a3c9c97d940e52495abb4d4f5aae5abf350699c5eb5ed575a3888
- MD5 8e57eaf3e74d30fa69a729515c829ea9
- SHA1 d5cdaa8cf5f72ccfbd2736b519fedf236d87ddb9
- SHA512 b2f5b45976b8e96ebe52451e93d050bf645a6489c239a79186691e37074fd94b915a6cf1febf36252898ca4e5abf4d100e92a8dad416128de55d6efc97db3530
- SSDEEP 768:hbo0u/4V5Wg+kbS04UMTE3KVYck3gMYOQHSlAhTzwuLjIVp2mlEBfApj3eRkJyoZ:hbh5S0Uk3CzHkJ1IkLmQwOqYvtBZP
- TLSH T12583A45FE17B8798D8C31EC1B08373BD953AC24595D71977294FA48CB088A99EF923C2
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvdu.dll
- IMPHASH 5ec90e7e129e80b61f5c79192d10e7df
- SHA256 09eba25afaa70d8794590f8b8ae431fa2f7ef6c113b7dc69493043043cb27f0d
- MD5 b3b11c9bf4cbd959243c59024539f82b
- SHA1 08639acc79d341d14ab33fb73a6441c36b0c9c07
- SHA512 3237f8496504eb54c168e670851e6b6e8edc2bc3cb30e893d50f7221141769803b30dfc070219337b4d20fd281f14db59bec91526b34da06eff338371bb2f397
- SSDEEP 3072:YfjubBQFZEhn4JdX66O8cu3fknGLs3a6BRa6Faa6Ca6YBxAkfnVI8fVlug+KI67L:a9FZEh2XlOg7sRsBGkf/9lugpr
- TLSH T19094FA11D7D17A25E5773A30D16B3B30C26AF43AE726D38FB10E85D998326D29E60336
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
31621
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
H:\WINDDK\3790~1.183\lib\wxp\i386\SSPCL6DU.pdb
msvcrt
_wcsnicmp
qsort
wcscat
towupper
_ltoa
atol
wcstok
_wcsupr
wcsstr
swprintf
wcslen
wcscpy
strncmp
wcscmp
_wcsicmp
_wtoi
strstr
user32
CharUpperA
wsprintfW
LoadStringW
SendMessageW
GetParent
SendMessageTimeoutW
MessageBoxW
ReleaseDC
GetWindowLongW
SetWindowLongW
wsprintfA
MessageBoxA
GetDesktopWindow
GetDC
kernel32
GetCurrentProcessId
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
GlobalFree
HeapAlloc
GlobalAlloc
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
GetPrivateProfileIntW
lstrcmpW
GetPrivateProfileStringW
lstrcmpiW
WritePrivateProfileStringW
HeapDestroy
HeapCreate
GetLocaleInfoA
SetLastError
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
SearchPathW
GetVersion
GetACP
GlobalLock
HeapFree
MulDiv
LoadLibraryW
GetVersionExW
FormatMessageA
LoadLibraryExA
GlobalUnfix
GlobalUnlock
GlobalFix
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrcpynW
UnmapViewOfFile
CompareFileTime
GetFileTime
CloseHandle
CreateFileW
WriteFile
GetLocaleInfoW
MapViewOfFile
CreateFileMappingW
GetFileSize
LockResource
LoadResource
FindResourceW
winspool.drv
EnumFormsW
GetPrinterDriverW
GetPrinterW
SetPrinterW
SetPrinterDataExW
OpenPrinterW
ClosePrinter
GetFormW
DeleteFormW
GetPrinterDataW
AddFormW
SetPrinterDataW
gdi32
GetStockObject
GetDeviceCaps
GetObjectW
EnumFontFamiliesW
ExtEscape
DeleteObject
CreateFontIndirectW
SetTextColor
SelectObject
SetBkMode
SetTextAlign
GetTextMetricsW
CreatePen
CreateSolidBrush
SetROP2
TextOutW
BeginPath
EndPath
GetPath
TranslateCharsetInfo
StrokePath
StrokeAndFillPath
shell32
ShellExecuteExW
comctl32
CreatePropertySheetPageW
advapi32
RegCloseKey
RegQueryValueExW
GetUserNameW
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
DevQueryPrintEx
DllInitialize
DrvAdvancedDocumentProperties
DrvConvertDevMode
DrvDeviceCapabilities
DrvDevicePropertySheets
DrvDocumentEvent
DrvDocumentProperties
DrvDocumentPropertySheets
DrvDriverEvent
DrvPrinterEvent
DrvQueryColorProfile
DrvUpgradePrinter
PrinterProperties
Name
.text
Size
115KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
253KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=147, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=92, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=32, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
itdrven.chm
- SHA256 d19ab054af55ad8342bb62dd05df9e673fad49eb74f73bfb3001d6fa46f8adb6
- MD5 7124fff9933a90214e8596f275d50cb8
- SHA1 0df42e617cc628b35b87df5af77628a9930985f5
- SHA512 d2c10de595407bff8f3d2fcb50683920c588d32e412c14d24b76a187fc27fa2c4d2ddb4b7054ac8163a89d9e9431f171813f1e184eed8f8351d3e26009b6768f
- SSDEEP 768:zw/tWXmpgudCSzymLee/6/749rQNez5D2iwE:zytWXmUuK09roW5D2iwE
- TLSH T198E2D18B3E75C336D411AF735EC3A3D56794CA00A7E5F6022E0C5239859C36C5B746BA
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrven.dat
- SHA256 96af9bdd0d3052b036ec765d4bf3a99d3e58f366ddc2084c8405b656d0d908ac
- MD5 4df9a5b384bbe39ac97c904abdce1ab3
- SHA1 9225c7b270fea1c57f2788c425cccbca1b73da93
- SHA512 1e83333f9e42de7db5b1d4fa1bcd35d1464f70077331c66c8fe1cea80fdb933b865c16ac80b129ea51dbd9b09d816fb5c88e9fcae8d497505353eb854138163b
- SSDEEP 1536:wJ2jjIokZMR5aZV4cXkLsRxIkBpe3s/eDRXIHR:w8pkZWGzXkLsXIkBQbRa
- TLSH T1F973545FA0670BA5D8C30DC270CA76BE963AC25982E25837784EE48C714D36AD7973D3
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvex.exe
- IMPHASH 96aaca3dc817e2424267e76cd6ea1bd0
- SHA256 d7332c375be154b8e4ea13ba9326ff03bcc7eb30c3e0b0ba62886ad18e9cf867
- MD5 177bfcaec6ee885b8544184d0e5aad9f
- SHA1 cd3cd4cac5f884417a9ed0c798e4063e476f95e5
- SHA512 baa6254f6688148ee91a0a94baf993ee3cdb579edab3d6557bf23ff7a617a21ee3dcb2dc1de52bb207421fb0f039dc91dad3965b29a54190e02dfe4d5ccb8dfd
- SSDEEP 768:Wh38olTHNzrhhJaklEv1bHnAIYtXUE1DiAjuxSNeZnwltkAa:WhM65WbgIqXdDZKSMiltM
- TLSH T16133180A7C938033E0024CB58BD586C15FFF5C1336E3A67FEF9405595AE229C59AAAF4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8058
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
CloseHandle
ReadFile
SetFilePointer
CreateFileW
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
MultiByteToWideChar
LCMapStringA
WideCharToMultiByte
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSection
RtlUnwind
HeapSize
user32
wsprintfW
Name
.text
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=125, productName=VS2005 build 50727, version=50727,
count=78, id=109, productName=VS2005 build 50727, version=50727,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=83, id=1, productName=Unmarked objects,
count=30, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
itdrvfn.chm
- SHA256 e2b16adc29f4c78181c0c0c2c98f49f32f2a43a63de3b5d62a2802245a7ecd17
- MD5 ae67c440c0476582a5b0eb01ff7efd33
- SHA1 2b90c5bd72e07601bae7db4c6e30eb799a2589fc
- SHA512 e15db91397f0a7e72c5b0a15199faa8540a6a7ba191ece71f3f0ab3f0357c6b16121ce213f4d82537368cd6f8318d1fe8bd51f091737bb0796fd8ffddc9730e7
- SSDEEP 768:sqEmsuN24EWPojviikjh00rC0J3u1YAnMG8wuivSm1Krg:sqT24JQOikj1+05bAnMG8PivKrg
- TLSH T173F2D0BE9CB05569C4555F337DEBBBEB14844A25DED0B191B40E723923E03EC11A53B2
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvfn.dat
- SHA256 b3c1847b0c211401ba9d5299dc3a9dbcdacbac956afcfe472dc9f1a6e29ee6b4
- MD5 3944f43bb70e78581688bc6f1a9b9860
- SHA1 7196f4edcdf1b923b41abbe45c91deef8905948f
- SHA512 0e4c2e6c616ddcfbc0d7bdf4869978bd390be33be1242f3eb8e12dabe2c603730a70cf9580fa89abefb7e810e416f1491bfa857240f7cfd4b9effca578552af5
- SSDEEP 1536:o/02s0UcKtkQLUzp8nUkgLvNkgKsUd37zW9:o/02s0UcukQLypAUkgLvNkgK5I
- TLSH T1B293961FE0E60791C8C30EC5B487B6BFC639C249A1D6D936785EE18CB18C66C9B57392
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvhb.chm
- SHA256 b974a0712187c7f6416e3ca5a7c8dc4ca3ac159b39d12f25ab00274c6368d6ac
- MD5 18abf11711a8ce2b8594247289b03909
- SHA1 b5e52010d5856f079caed78b00351ab824d24285
- SHA512 95ec4f768e04ca51f93bbc423f73e3b5bd25fc020f1de4c18527a66ee9b3483c615e5128188b8b23ee1a8b7ea68d5cbbb72ad9901d58734cf47fb665f941adb8
- SSDEEP 768:QJAr1s5frYJVmqPmtasc7YVqS2fp18lvuR/R:QJYWYOqPpsOYVqXfh
- TLSH T141E2D06DEC74EB76E0120F77A9FB1399470484495B6AB142191DF4B9D0CEB2335A1CF8
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvhb.dat
- SHA256 1642ddb58330fec81af7a00ddb3920b854f8fa5a4bab99e15c092e66ab789c6b
- MD5 b0f7597cc314f8282acec3318fddea66
- SHA1 8a4bcec114772f54e1a375fb572e00879c04de4c
- SHA512 5069c0c0e57b313866f821da5edf30ea21a4ff43562f93c57f63ba2893fc356c20efe4563c13fe704c5b5093e88be4bfc51fd2bcb5c6b30f71188d0227bcda04
- SSDEEP 1536:+wNJxFysfx9pGb97XXg9q8CtC0UgqH0wUgqFHHjR1HjRFmscVfjwfmI:+nTXg9q8iCVgqJUgqFnjv
- TLSH T1EC73A38F8C6A0BD5D4C30DD2748B77BE4637D26442E26C37389FA49CB04E25666A73D2
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvhu.chm
- SHA256 1df23b5f76c55fafbcc86dd4707a2744144d3f614e2400ebed4cb1157447fd9b
- MD5 0a5cc89ddc125cc6d3e18539438827d5
- SHA1 638070ace6c036c8bab63e9bbb51a220fe1332fa
- SHA512 fd0c90edc20ed23a52970f2c1668386769851e03c46bed56331fc5971fd61059b08d01c4c4de0d25223a0097f821116c23744be619c9ed8326ef0f0e32471b5f
- SSDEEP 768:GD8wdC809Tpgesag3GLIN/vZj7YfIfnOM4:GQwZ0/gesag3G8NJjMAvO3
- TLSH T12CF2D04E5E204BA4C8112B3B94DB37D6675AB823EF12B00D070EDA7D71F531CA5E46B6
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvhu.dat
- SHA256 132409ae63da6c2b3533ed2f214284cfba321127cd22329bf3db31edd3ccef4d
- MD5 ebc20e6ab0e70ff5e4b1d3983aca1ea9
- SHA1 31f0b93e536740fbc790524baba5533c73d016a6
- SHA512 910f7774e437fc9d7b92260f5220bdc4b7b73ff4d231240b5f27de40edaf6a4c208ce3196d68f906be7375850c37dc6bc161a69d48f0bba11fd0e84f66f77d2d
- SSDEEP 768:6WZH06qw4Jg1Mf+Exb967k3cyrUijUQ45zuuFjJvs3uuB74ttRQM0wKpkMpcukKv:6b/JnSk3x81FFvc7rkMDiwkMNpF7UF2
- TLSH T1E983834FE86B0BD5DCCB0DC27157727D0539D39489D2C873398AAC4CB04CA995EE2B96
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvlf.dll
- IMPHASH 777d05b47238f457a953f2db40559e31
- SHA256 997e0fdb3f80859c0c08c9424a55d1d236994408ce130fc43f9394450604fbad
- MD5 b4fe97c34c05384048ad63b822a32ca1
- SHA1 5b4ec39ff47ceefa6a698e89802c2e44aa808175
- SHA512 bcac4a4d6454821acfb4717210922f1a7800be635c368889050115bf5e09f04d2881954af50f420de57d5a82d450c747785ab6e828e7755e7b986de3a956f295
- SSDEEP 768:KNXUncKg2YO82HFTHz6YjnXU1HNFLEoWGa28DJ3B+E8g9t/:Kan/1YerXURrJa2wpcEjt
- TLSH T1A5632A093853C0B3F0054839D2C587D21FFE6D137BEBA46FFFA6064949D1199A1AAAF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9156
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
Sleep
FreeLibrary
GlobalAlloc
OutputDebugStringA
WideCharToMultiByte
GetACP
GetVersionExA
lstrcpyA
GlobalFree
GetLastError
GetProcAddress
LoadLibraryA
lstrcatA
GetSystemDirectoryA
FlushFileBuffers
CloseHandle
CreateFileA
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetOEMCP
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
winspool.drv
OpenPrinterA
ClosePrinter
GetJobA
InitializeLF
ParsingLF
RealizeSPL
ReleaseLF
Name
.text
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=125, productName=VS2005 build 50727, version=50727,
count=30, id=110, productName=VS2005 build 50727, version=50727,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=95, id=1, productName=Unmarked objects,
count=94, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
itdrvm.dll
- IMPHASH cd73f866561a0e74b89f113154dc5db2
- SHA256 dce6930c3e9a98a0834cda7654d9c1e2860fac462404f0104c96b21034f4b1a8
- MD5 33aa93c2a746d48bc552e48a52f2e00e
- SHA1 b4a9fe72c682ea617b0f7bdc4cdf0133d4d13a78
- SHA512 a241549dde849673cbc207f4d2499f10d4c86eaea56cb845b268c5aab9b12a94a5142bb19d21d6e3eabc415cd07210c3fcb52708345f7688a0a57793a767fb1a
- SSDEEP 6144:4xWr4HKvALXldPpXmAwLyTHzCxNrYSedzC1dtm:zA5NNiOTT
- TLSH T11964B03D61828136D3FB0F36743E8E5F76BBAC018BA955AEEAD43B6859F00444EF4152
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
67261
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileA
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
VirtualAlloc
GetCommandLineA
GetProcessHeap
RaiseException
ExitProcess
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
LCMapStringA
LCMapStringW
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetCurrentProcess
GetThreadLocale
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetOEMCP
GetCPInfo
InterlockedIncrement
GlobalFlags
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentProcessId
CloseHandle
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcmpA
GlobalAlloc
FormatMessageA
LocalFree
MulDiv
InterlockedDecrement
GetModuleFileNameW
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
GetModuleHandleA
SizeofResource
GlobalLock
GlobalUnlock
GlobalFree
FindResourceA
LoadResource
LockResource
FreeResource
lstrlenA
CompareStringA
GetLastError
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
GetPrivateProfileIntA
GetPrivateProfileStringA
CreateThread
GetVersion
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetTempPathA
WritePrivateProfileStringA
SearchPathA
GetModuleFileNameA
SetLastError
GetVersionExA
GetLocaleInfoA
user32
DestroyMenu
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
GetWindowThreadProcessId
SetCursor
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
PostQuitMessage
ShowWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
RemovePropA
GetFocus
SetFocus
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
GetKeyState
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetClientRect
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
LoadImageA
SwitchToThisWindow
EnableWindow
SendMessageA
PostMessageA
wsprintfW
wsprintfA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
CopyRect
PtInRect
LoadCursorA
GetSysColorBrush
EndPaint
BeginPaint
GetPropA
ReleaseDC
EndDialog
GetNextDlgTabItem
GetParent
IsWindowEnabled
GetDlgItem
GetWindowLongA
IsWindow
DestroyWindow
CreateDialogIndirectParamA
GetSystemMetrics
SetActiveWindow
GetActiveWindow
GetDesktopWindow
GetWindow
GetWindowRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
DispatchMessageA
gdi32
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteObject
SetMapMode
RestoreDC
SaveDC
GetDeviceCaps
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
winspool.drv
ClosePrinter
GetPrinterDataW
OpenPrinterW
DocumentPropertiesA
OpenPrinterA
advapi32
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
shlwapi
PathFindExtensionA
PathFindFileNameA
oleaut32
VariantClear
VariantChangeType
VariantInit
ShowDlgSetResult
ShowDlgSetResultHidden
ShowUtilsDialog
ShowUtilsDialogHidden
Name
.text
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
104KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=21, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=477, id=1, productName=Unmarked objects,
count=26, id=125, productName=VS2005 build 50727, version=50727,
count=135, id=109, productName=VS2005 build 50727, version=50727,
count=123, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
itdrvm1.bmp
- SHA256 dadb29872094b611683b38f3d3b6fec1a9bcb48d90b68219db5b2b3520c286ca
- MD5 8d5c6b0cb90177576dca148c7bb582ba
- SHA1 00579973dbe3b1c65efe343d72f49b7412af3685
- SHA512 08a30086fe242d81612a440016b48682be496795f2b01246de494ca3dcff49bb53fa84f1d326074828e38cef923c30938e2099afd6a66f92e0ac6b8596342286
- SSDEEP 384:UPDRkTyff5+cTdQJ2qrQR/Rflt6cFRWXsAhg3Togjqy1+VWZo:GDR2JpBrQR/RS/hg3Th3+Aa
- TLSH T100037B52E502F255A6B3E92DD2BC45F0022B7D26C61B7E43F2233E547A39E497D10B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvm2.bmp
- SHA256 55b75298ba496d8b3e3a5c238e0c62615322ea3c91a1b424e678692ff48954b1
- MD5 8b41a1264b79b78f26f7c66651b59535
- SHA1 f0e6fb64ce854ef46cceca59c48d6de794f7fbd1
- SHA512 332d6427a7744f98b4d975d4880ccd0c74613e92b352eb391755807754bb328d9fb08a3ee49e173f1c05e75dc9deba133d5a656f2d5d56fad4f72ace6771907f
- SSDEEP 192:26TMabG3s9rGnrnZSGQUVRJDHTPt0JqF6OLZtmcdbwoVjBGF+3hHw++sHH62sAzD:26Ma7inZJzmgtm6VjA43Vw++462sAzD
- TLSH T1D2D2C55B6731011CCAAE0DA1672AD549722B7F25F92760C8FAE37F948A3218D071DDCE
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvm3.bmp
- SHA256 f345fb038a09dbbe2a7e5609d00bc591c94aa3ac98d30a5f15edd087e45741fb
- MD5 985f4c501476363e301175c1abec812f
- SHA1 2a942073087ebf80a72ade92fc3fd6a8dda30721
- SHA512 454f4a49c48c2d3fedfc142ddbcbe976d001ee47405de5aeaa46946b4fa9036acc52203743b0c66f81a6b2f8ebe3ac50f0314e240f5a3adda3e6d220cc7e4072
- SSDEEP 192:FlnvmOJjMyZjcyp9s+3+1GHymyqIJRPqd:LvllnjJpL3+1UISd
- TLSH T1C3322F81A4685AC7D50BC4327058B01D72ACE89F472F03577038EEFCD99AF035869A1F
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvo.dll
- IMPHASH e3397b5619b4c46668acc2b4a97e4d5c
- SHA256 5bc557ce7676879a3bd967848638c38b2a4a4a196ede017d643fc0e84fb2755e
- MD5 41a92171cf287cd614046f6819868b84
- SHA1 29528d1ebf1c3bd1e84ccc00053633ce56a4b3c7
- SHA512 90bff775025864c84bcb2d70a6973dd819cc142b26ab2d8830e872ca37aa0e7b0a2338afe1469c0282cb9cfb244194de3f119e4daf75875966e8daab6df8a9d4
- SSDEEP 3072:I/SbQr8N/+nF8yqLBYMLLdun31R1aNLRtFdbAttc3T3:2LYNsNqLBhLL031RaLZd8c
- TLSH T1E9246C1132C2C476E2BF133A49A7972867BABC519FB6D24F7F907E8DAE301558E24311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
60979
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileTime
GetVersionExA
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
GetCPInfo
GetOEMCP
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
VirtualAlloc
GetCommandLineA
GetProcessHeap
ExitProcess
RaiseException
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
Sleep
VirtualFree
HeapDestroy
GetFileAttributesA
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetACP
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedIncrement
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedDecrement
GetModuleFileNameW
GlobalUnlock
FormatMessageA
LocalFree
GetCurrentProcessId
GlobalAddAtomA
CreateFileA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
CloseHandle
GetThreadLocale
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
ReadFile
SetLastError
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
GetModuleFileNameA
EnumResourceLanguagesA
GetLocaleInfoA
LoadLibraryA
FindResourceA
LoadResource
LockResource
SizeofResource
GlobalLock
lstrcmpA
FreeLibrary
GlobalDeleteAtom
GetModuleHandleA
GetProcAddress
lstrlenA
CompareStringW
CompareStringA
GetVersion
GetLastError
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
GlobalAlloc
GlobalFree
SetFilePointer
HeapCreate
WriteFile
user32
LoadCursorA
GetSysColorBrush
ShowWindow
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
AdjustWindowRectEx
CopyRect
DefWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSysColor
ReleaseDC
GetDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
MessageBoxA
CharUpperA
PostQuitMessage
GetClassNameA
PtInRect
GetWindowTextA
SetWindowTextA
UnregisterClassA
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
DestroyMenu
RegisterClassA
PostMessageA
GetSystemMetrics
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
CallWindowProcA
gdi32
ScaleWindowExtEx
DeleteDC
GetStockObject
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
CreateBitmap
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
DeleteObject
GetDeviceCaps
PtVisible
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
advapi32
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shlwapi
PathFindExtensionA
PathStripToRootA
PathIsUNCA
PathFindFileNameA
oleaut32
VariantClear
VariantChangeType
VariantInit
MakeOverlayFile
ReadOverlay
getOverlaySize
Name
.text
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=21, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=468, id=1, productName=Unmarked objects,
count=25, id=125, productName=VS2005 build 50727, version=50727,
count=135, id=109, productName=VS2005 build 50727, version=50727,
count=119, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
itdrvpc.dll
- IMPHASH 432a9235ef2e1e316d390700f6b82255
- SHA256 60f9c924a011b9dd8e870aeebc3cdc7cb8e07fab0f28448fbf4f99f42e408251
- MD5 dd0da53d125f6bbfceabbafebd70dad1
- SHA1 571e087a5c72545c5b8f6a7a8465b6f8a1060188
- SHA512 6d961975c6b77670e4f1a8e8f100693b98bbd7be5057f509e09354d25fdc15b504da0fd1b170b8cad7782284647a77b633f4771344e01ffbe166bfd79aabc1f2
- SSDEEP 384:b1sOVnZDpTBPRceEyY6OJImUsnzx6v950YODHWO89bMI8xNMJoLk0:buSn3BCDyY6G3nsv4bDWOkMIkMJOk0
- TLSH T15B9208D3FAA58452D97696B068642D0533B25E6000359DF74F041F4F29F8993FBBAA33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
16356
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
malloc
_adjust_fdiv
_initterm
free
wcscmp
_vsnwprintf
wcslen
_wcsicmp
_except_handler3
wcschr
_wcsnicmp
iswctype
wcstoul
kernel32
GlobalAlloc
lstrlenW
GlobalFree
GetLastError
CloseHandle
SetLastError
CreateEventW
ResetEvent
SetEvent
FreeLibrary
GetProcAddress
Sleep
GetACP
IsDBCSLeadByteEx
WaitForSingleObject
LoadLibraryW
spoolss
StartDocPrinterW
WritePrinter
EndDocPrinter
ReadPrinter
GetJobAttributes
GetPrinterDataW
SetPrinterDataW
OpenPrinterW
ClosePrinter
GetPrinterW
gdi32
TranslateCharsetInfo
CreateFontIndirectW
SelectObject
GetTextMetricsW
StartDocW
SetBkMode
StartPage
EndPage
TextOutA
EndDoc
AbortDoc
DeleteObject
GdiGetSpoolFileHandle
GdiGetPageCount
GdiGetDC
GetWorldTransform
GdiStartDocEMF
GdiDeleteSpoolFileHandle
GdiGetPageHandle
GdiStartPageEMF
GdiEndPageEMF
GdiResetDCEMF
GdiGetDevmodeForPage
ResetDCW
SetGraphicsMode
ModifyWorldTransform
SetWorldTransform
GdiPlayPageEMF
ExtEscape
GetDeviceCaps
GdiEndDocEMF
CancelDC
CreateDCW
DeleteDC
ClosePrintProcessor
ControlPrintProcessor
DllMain
EnumPrintProcessorDatatypesW
GetPrintProcessorCapabilities
OpenPrintProcessor
PrintDocumentOnPrintProcessor
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
554B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=25, version=9210,
count=77, id=1, productName=Unmarked objects,
count=3, id=93, version=2179,
count=3, id=15, version=2179,
count=1, id=92, version=2179,
count=15, id=95, version=2190,
count=1, id=94, version=2179,
count=1, id=90, version=2179,
itdrvpo.chm
- SHA256 e95e7548c0f1f82ab2036bffbe3cc60856153ed3f7802bfdb1b00c9107d5d4a7
- MD5 af89c46ab25aa08db9d94518f4245e72
- SHA1 7f6a8359f341b23b694a7b4e1d31334f3887d167
- SHA512 7185d604a4132ce366a8e3e8925c9136c97491d5ea81cce3c6509901f16ed9297c30ac2f059361d10905c20e60b8e86ddbb41dc47e4505d7b2d1eadb1a837fac
- SSDEEP 768:244wUrlcx1WA3mVizstnPWWMCejdicz/8kvQLhQuIhf:24f6iWA3mVizsBPWxCejdCB1sf
- TLSH T13CF2D04EBF3192B6DDE14FB77DE73509A2289C413BAE709A105C707412F57299321B71
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvpo.dat
- SHA256 b1b3bda7e7c46f2223e269401ccfd4056c45540bf0045f933ef15a1b4db16ec2
- MD5 fe896085ec1f0f178e0f7456600fd660
- SHA1 0cf6637669b90b7e13a48cb71cd5134f3ecaf709
- SHA512 807c949b81a196a8971a37d8ebf6a4b076b367cd651eefb296ed43dc1615d373c38b786b6b3a76cb03180acd1e0ede89079f2ab43539edd308dbf9b45b782ca3
- SSDEEP 1536:731dd8M5ZjkTu/1NWm3gshI6g9kWzTkW/NlZeITYrvJR:731dd8M5ZjkTu+KUkWzTkW/NlZbMJR
- TLSH T14C83B70FF5A70A64C4D30ECA74C777BD4A7A924091D27D37788E649CB2492185BAE3E3
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvpp.dll
- SHA256 d4d652958d7489eb715035d36b1e4c3c0624c1d3bb21e061fb84829560e4d0bf
- MD5 e30b7e95b69f3516b4d4c426813b9233
- SHA1 a74b8ef529930a8cc352849b6fe342cd98086fcf
- SHA512 61a505b1b8aba6d0a547e17fa5c0145290d006c0dd026b3296fee4fd00a4da5eeb4eeb34d14b181065d065667867753d63318e00581c3795c89c73998718dafd
- SSDEEP 384:gzUmuvPOq2JhHKkxek8kYeYX11ysMBWg+KY8Y:Jmu30x1YtbQ68Y
- TLSH T1F862847E9169C158DF74A8DD76A176D0C2B351A233A084FF3D0ECB544B825B6EFA4308
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvro.chm
- SHA256 cedb540abe52e8cc8a0431bd2271f0b0f4f932d19d000b04dc30d03477a49fee
- MD5 1c71432a1c68701fedec2be494c81532
- SHA1 89272408f5d151f9449dee9e63f51cac77fc6430
- SHA512 582bb6ba6d5b0e666226ffd990eb668c1af9d13cca0bffa841b468f20ae5aeda7885afba5160d920833120e1a40d7dfe7ad9fe7d46eb9a32cc1a6c1e35f1c493
- SSDEEP 768:HeqZAspmoHYVRH+vHatYBoG0wCTFE5mdBjMA:HeqrpmN+Syx0S5oBAA
- TLSH T16CF2D08C2D2183B9D9441F779ACF3A4F9921AD248DC3328D183E943D66CABCD9230E35
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvro.dat
- SHA256 54521291e04e0129d355566c7d85563ab9b86c05555513f0706c4f2ad72cc38e
- MD5 f60966e82aea5b71dddae527f58ac873
- SHA1 1c2ec696a93a3fb9fe12b4c21469bd5b22a3caf2
- SHA512 621cbb5688e9e9b64ef61309650fb7b19fa63910fc1723aaca16d469a9c80636dec0fdd068046e5e7ebd71aa02c42dbfe3440241b303c8a786d76d5bff1b695c
- SSDEEP 1536:U5YBL1ooSPts9k6xKme5vcDnlustXkyQEUstXkyb/zBreY:U5YBBkuN7sstXkyVUstXkyb7R
- TLSH T11483A44FB4B603A1DAD30ED2B1CB737E8DA6D24C51D69DB7744EA08CB04C7AA4725782
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvru.chm
- SHA256 f8cf1e471ad24a40ebd425c1e31929afd043d393b059cd8cfa3db061c6601df8
- MD5 48e926924d76a695dd6edc924d546c25
- SHA1 4b9b8f120bedb1ed0c5ca4a2f748963bcd25d1c3
- SHA512 902d884ac37dc7b751db9db14c0823e8b7b70ff0d1eb1360f52084d077b0b692374c6e97fc36bfa6b41abf4b51a63d47cf8f09e9a8f76bdd20c1fa083a3f4267
- SSDEEP 768:dKyfEk4anbRqYRPK1aertbVtKX41cJKqab8eZxGu:dKyEvanbRqYRPK8exQ48emu
- TLSH T1C2F2E159DE20A6B4E5DFCF335ED73B801210A90166A3B2093C5CA476C1D635C16EB7FA
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvru.dat
- SHA256 ef8f94b9d2c7a917fcab35f9c96c1bd1838fd8c892dbbb9ef815aabddcbf6be4
- MD5 bc823fe41278162ccd34d7f7817bb2e6
- SHA1 f14455bb31519535b96f85ab62062b01e8e096ad
- SHA512 1900afc41029132f30fa19ff9ba8332ea71178897ad0c3c878e82ca8a72397d7e6f68979a60d189e66f50f9649118fa3519aa07f3054dd64978052a6e1776ad3
- SSDEEP 1536:mD395416peYJPZKNlC5TE2KhxNfzCw9WZEd0oCwfXARsnZzCgRL:S9541M2lC5ToxfzCw9WZEd0oCwfXAR2H
- TLSH T1BF83F74BE4370B98E9E30ED574C7777D0A7B8249A5C26A36740BF48C724826A27937C7
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvsc.dll
- IMPHASH da731441e751ce8830fae1eabb2f6255
- SHA256 8b1451fccd09ffc7b7882c0509edc0b183bcdbab3826040ed12305252301bfc9
- MD5 5abc8d4eee59f4b3b45f7476b526e2b2
- SHA1 45fa5130fa69fb21482fbbc045afafd7dab7cfc2
- SHA512 51ce4cd8c263fe2bc14e2a8cde064c2ac2672c1d4857f49a4c9e44ad503b5fc8f5f400683ad94b9a8da1e59a138db7e0a5017428b8acd5da3ad599b91b3ce9de
- SSDEEP 6144:fq9DSNNWyhYjUgK2l5Ol3VxYcezA8MtQzLO68iy9Pfwu88oretwWbYgI49OREzL:CcqGaxl5ObuzA9QzLOlx4/bx4vF
- TLSH T159B4CFA0D5D640F4EF1F1CF4194B34768A7A6FA70A16B1A3EB1CF9938C72A41C936607
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
137717
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
OutputDebugStringA
LoadLibraryA
GetProcAddress
FreeLibrary
RtlUnwind
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
GetLastError
CloseHandle
ReadFile
SetFilePointer
InitializeCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
ExitProcess
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
SetStdHandle
FlushFileBuffers
CreateFileA
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
SetEndOfFile
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
RaiseException
SCMS_CreateHandle
SCMS_InitializeConversion
SCMS_Process
SCMS_ReleaseHandle
Name
.text
Size
172KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
312KB
Virtual Size
310KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
752B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=14, version=7299,
count=3, id=19, version=8034,
count=78, id=1, productName=Unmarked objects,
count=120, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=17, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
itdrvsf.dll
- IMPHASH e78094c5d5b973f759380fb8f8cb5715
- SHA256 fa09c18a0059a5ae5fefbba0795a458ce11072aec62ff4030987ac4721389dd4
- MD5 15c688ed90f53d549668b122a7cf7e39
- SHA1 e8b7ccc6475171a6b1690c7bb7d00608ac889d69
- SHA512 74ca66dbdf8ec87cbffcf50f4a91f213655e4b95090851b9b44844ed0bdacd81f7621ba4838f98beeabcb783ebd27848c739e157fd7674097e2a10aca6a52c7a
- SSDEEP 3072:tGb+c/+WWRQGvZpg1iI1pVtNPsUifEbRbUSZavO+u8lyoRwN:tG9/+WWRFkbz96ZGD
- TLSH T184B418F3F8B9A9A3F72B9438602AF238829954DC9314C0DBB055FA2555337C0297DB5E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4313
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
HeapAlloc
UnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind
OutputDebugStringA
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetFilePointer
InterlockedDecrement
InterlockedIncrement
SetConsoleCtrlHandler
SetStdHandle
Sleep
FlushFileBuffers
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
CloseHandle
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
FreeLibrary
ReadFile
GetModuleHandleA
RaiseException
CreateFileA
SetEndOfFile
ApplyAlgorithm
CreateIP
InitializeIP
ReleaseIP
Name
.text
Size
208KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
280KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=14, version=7299,
count=110, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=3, id=19, version=8034,
count=78, id=1, productName=Unmarked objects,
count=27, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
itdrvsp.chm
- SHA256 6281e96f89f895e5f5fb46dc91cce88195c16d3697f9c3bd0f9c74002146a02c
- MD5 a54215501d879eed7e214ab8d472b4f0
- SHA1 1bec3df83656faa0e581b4b2d63fde182de93a47
- SHA512 ee8311147cf97fd954b909ff310ac5147e9c705d2d6a5f61b70a357a48f4cc01a64f808b4a7a6abefca775632026d0aef02dd94bdb27637c9e0fcbe7a622d399
- SSDEEP 768:4MMFPa4pO0XzdJTGrLgNSCYEDEvpoY8u1y89Z3qRV4R:4MMFRpOgTGrLgYCYRpoY8u139dqz4R
- TLSH T178F2D03F8D164364C0B90F3FAACB1BAEA4B095028DDCB515711DFC30A96E3AD16266B5
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvsp.dat
- SHA256 d755c10210c17dace4636cd4afa62bef2804c491bc26d2e703da3afdd0541bae
- MD5 42383cac596da4d71095a9946e26fdf8
- SHA1 f7510983f9e0e754c1e94051d0db992f87e416c3
- SHA512 c7340e4043b039158aef6587caa86139f0cba291347c19e34480e6d664570809a7d649830eb90c17d387c7b48f5dceb4fcb4d94279bd366c0cd06042a666210a
- SSDEEP 768:MSwbhbr4420cISG6GnOD7kP/xXS/NukqC75OEwdnCuW6xd0X9Rru0ZN7kQLSezvi:MSch5hnRkq3t+kQWQkQkcVkPVzRINrrW
- TLSH T15283642F90E90B91D9C30AC271C7F67F8576C285648BD973745EA08CB08C79E8B66397
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvtk.chm
- SHA256 ab9bd61948aff8c4433d1c9c49685eaf6359e5dcf61e54ebcdee4ab5ad639175
- MD5 a3dc8e90e5059bd88d003ec38b6a245b
- SHA1 c815297bf43d6deea90bc05f3bbf034e9b91a297
- SHA512 a051ae176aefe5e344276d4f23348d7df0e41b3787a97651e4e85d004c7d0da40bd1f5e1379bfdaf05cd3e69c22dce2b49fc04679b89dfaa10ba3c2c1042af4f
- SSDEEP 768:4atkXwyCebNTXDlBDnz0N107bybF2SUJ95lG1fPew78Ri:4atuwHe5TJBD410AFn095lGf7z
- TLSH T175F2CF5FAE10A238E8956F371DD32B6F9C168C1113E97D56357DBD3A54E6B0E2008AF0
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvtk.dat
- SHA256 5143b0a896326ba7aa4c3a96b13dbf559a9b9bb9d4414fd07065cdd621e070f8
- MD5 5ade458891e33963a99dcb50c7d495f0
- SHA1 071ed7921802f0e7121eb6938357d30c3ce4e3c3
- SHA512 3e4ba44d0a37b92a17c58c10512c516896265bcbeea26982571e3e54d3fd155248642dfca907edcac409b35ede02cd49d45a0e74811c927a55351b4a355e1579
- SSDEEP 1536:MFvL2VxwkE3x/qAoar5r07kE4GkEyQkfhrowUUsuW1Cyrv:Ms3wkE3x/jFckE4GkEyvhswXsuW1Cyrv
- TLSH T15F83A50FD8F30790D5C30DC6B4CB72BE1136C21695E2DC73394AB88C728976A6766B96
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvu.dll
- IMPHASH eedd03c901993c31fda770051792ada2
- SHA256 be0d62bb3d5b00340f5a9dbae9d41336499d5302594ec951b6abe1545beac125
- MD5 58030bf0770d7e2db15da79fb7a08214
- SHA1 a09ea92638ca2cee1f35751a60435b8818660323
- SHA512 e662d887d3c5a8a9232bab919708ad4547660bf6a2712b132cdb7d0a126e9233803862b8b6b3d32ff62b036d12900a913d0c40f2113ad549d5d49454a9b17484
- SSDEEP 12288:Missm3yt0ZIqb8p4OUR9CA2nrbyhbmQf/9T798ctlC:Mlsm3yyZIqb8Cr26/nZJg
- TLSH T1D1256B01BFD9C139F27E163614B6571B1A7A7D915734CACB6A147EAF2C30AC25E38322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
409738
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
wow32
WOWGetVDMPointerUnfix
WOWHandle32
WOWHandle16
WOWGetVDMPointer
WOWGetVDMPointerFix
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
imm32
ImmAssociateContext
vdmdbg
VDMEnumProcessWOW
VDMEnumTaskWOWEx
kernel32
RtlUnwind
GetSystemTimeAsFileTime
HeapFree
GetCommandLineA
HeapAlloc
GetProcessHeap
RaiseException
HeapReAlloc
ExitProcess
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetTimeFormatA
GetCurrentProcess
Sleep
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetCurrentDirectoryA
GetDriveTypeA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
FlushFileBuffers
SetFilePointer
FindResourceExW
GetThreadLocale
GlobalFlags
InterlockedIncrement
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
GetFullPathNameW
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
FindFirstFileW
FileTimeToLocalFileTime
FindNextFileW
FindClose
GetCurrentThread
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
CompareStringA
InterlockedExchange
FileTimeToSystemTime
VirtualProtect
GetCurrentProcessId
lstrlenA
lstrcmpA
FreeResource
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
GetVersionExA
GetModuleHandleA
InterlockedDecrement
GetModuleHandleW
GetLastError
SetLastError
FormatMessageW
LocalFree
GetLocaleInfoW
lstrcmpiW
GetFileSize
ReadFile
LoadLibraryA
GetProcAddress
GetModuleFileNameW
LoadLibraryW
FreeLibrary
CreateThread
GetTempFileNameW
GetCurrentThreadId
WideCharToMultiByte
GetTempPathW
CreateFileW
WriteFile
CloseHandle
MultiByteToWideChar
GetDriveTypeW
CreateDirectoryW
DeleteFileW
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GlobalFree
GetPrivateProfileStringW
WritePrivateProfileStringW
SetFileAttributesW
FindResourceW
LoadResource
LockResource
SizeofResource
lstrcatW
lstrcpyW
GetFileAttributesW
lstrcpynW
lstrcmpW
lstrlenW
GetVersionExW
TlsSetValue
GetDateFormatA
user32
TranslateMessage
GetMessageW
UnregisterClassW
GetSysColorBrush
DestroyMenu
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
LoadIconW
SendDlgItemMessageA
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageW
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
GetKeyState
SetForegroundWindow
UpdateWindow
GetMenu
PostMessageW
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
UnregisterClassA
DefWindowProcW
CallWindowProcW
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowTextLengthW
SetWindowPos
SetFocus
IsWindowEnabled
ValidateRect
MoveWindow
IsDialogMessageW
SendDlgItemMessageW
GetDlgItem
CheckDlgButton
EndPaint
BeginPaint
ScreenToClient
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
UnhookWindowsHookEx
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
OpenClipboard
SetClipboardData
CloseClipboard
GetDlgCtrlID
GetClassNameW
GetWindowTextW
SetWindowTextW
ReleaseDC
GetWindowLongW
SetWindowLongW
SetParent
EqualRect
RedrawWindow
SetRectEmpty
EnumChildWindows
DialogBoxParamW
EndDialog
GetWindow
KillTimer
GetCursor
ShowCursor
DestroyCursor
LoadCursorW
GetCursorPos
wsprintfW
DrawIconEx
DestroyIcon
DrawFocusRect
IntersectRect
CharNextW
CopyRect
SetTimer
IsWindowVisible
LoadImageW
GetDC
GetParent
FillRect
GetFocus
InvalidateRect
GetSysColor
GetSystemMetrics
InflateRect
UnionRect
GetDoubleClickTime
EnableWindow
OffsetRect
SetCursor
PostQuitMessage
MapDialogRect
GetAsyncKeyState
ReleaseCapture
IsWindow
GetWindowThreadProcessId
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
ShowWindow
GetNextDlgTabItem
WindowFromPoint
SetCapture
ClientToScreen
GetClientRect
GetWindowRect
SendMessageW
SetRect
PtInRect
gdi32
SetMapMode
GetClipBox
IntersectClipRect
LineTo
MoveToEx
SelectClipRgn
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
RestoreDC
SetWindowExtEx
ScaleWindowExtEx
SetTextColor
ExtSelectClipRgn
DeleteDC
GetStockObject
CreatePen
ExtCreatePen
SaveDC
GetPixel
CreateBitmap
StrokePath
EndPath
BeginPath
EndDoc
EndPage
StartPage
StartDocW
RoundRect
CreateDCW
CreateFontIndirectW
GetClipRgn
BitBlt
FillRgn
GetViewportOrgEx
SetStretchBltMode
DeleteObject
CreateRectRgnIndirect
GetTextMetricsW
SetBkMode
CreateFontW
StretchBlt
CreateCompatibleDC
GetBitmapBits
SetBitmapBits
Rectangle
GetTextExtentPoint32W
GetObjectW
CreateBrushIndirect
CreateSolidBrush
SetBrushOrgEx
CombineRgn
CreateRectRgn
CreateCompatibleBitmap
EnumFontFamiliesExW
Polygon
GetDeviceCaps
CreateDIBSection
SetBkColor
comdlg32
GetSaveFileNameW
GetOpenFileNameW
winspool.drv
OpenPrinterW
GetPrinterDriverDirectoryW
DeviceCapabilitiesW
ClosePrinter
GetPrinterDataW
EnumPrintersW
EndDocPrinter
WritePrinter
StartDocPrinterW
GetPrinterW
EnumPortsW
GetPrinterDriverW
DocumentPropertiesW
advapi32
RegOpenKeyExA
RegQueryValueW
RegEnumKeyW
RegOpenKeyW
RegCloseKey
GetUserNameW
RegQueryValueExA
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegSetValueExW
RegQueryValueExW
shell32
SHGetFolderPathW
ShellExecuteExW
comctl32
ord17
shlwapi
PathFindFileNameW
PathFindExtensionW
ole32
CreateStreamOnHGlobal
oleaut32
VariantTimeToSystemTime
VariantInit
VariantChangeType
VariantClear
VarUdateFromDate
SystemTimeToVariantTime
OleLoadPicture
ws2_32
inet_ntoa
gethostbyname
WSAStartup
WSACleanup
SSGE_DialogProc
SSGE_DialogProc_Th16
SSGE_GetText
SSGE_GetText_Th16
SSGE_Page0CallBack
SSGE_Page0CallBack_Th16
SSGE_PageInfo
SSGE_PageInfo_Th16
SSGE_RemoveCustomData
SSGE_RemoveCustomData_Th16
SSGE_SaveDefDevMode
SSGE_SaveDefDevMode_Th16
Name
.text
Size
520KB
Virtual Size
516KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
188KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
152KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=32, id=125, productName=VS2005 build 50727, version=50727,
count=160, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=33, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=564, id=1, productName=Unmarked objects,
count=188, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
itdrvu2.dll
- IMPHASH 5c54715227e960c5019e7a45d4b9d02a
- SHA256 845827e354d3bc3b3a75e21f732bc0089b1bdb4a22de733d005e30178cbb4767
- MD5 c9e38e55ebf83d867e67007477090c77
- SHA1 257f74437fa0caf5622ea1522ae0b78cb066e3a7
- SHA512 3693e70268a2cd0cc61c4491d136ea494a31ca1725a782d6a90d30e04e7b128064c3f7c36a7adbcd3c9fd91674de2cd816107099b8eb2e79bd2810fe8989d9e5
- SSDEEP 24576:HcuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuBuuuuuuuuuuuuuuuuuuuuuuuuuub:8uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuy
- TLSH T1C255D5D1B100D990F53E8631E5399EF816013DBCE6A12AAF78C47F2E3AB3252751791B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4329
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=11, version=8047,
count=20, id=14, version=7299,
count=56, id=10, version=8047,
count=65, id=1, productName=Unmarked objects,
count=3, id=93, version=2179,
count=1, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
itdrvul.bmp
- SHA256 bd92ae66673bc72b84bdb06fca50cc872bb3648b5ecc5102eb8b0742c8023a39
- MD5 294fc2b30a6ad71de36d7f684eca018b
- SHA1 018330bc049faa04d83093b9731e1774948c64e8
- SHA512 f2ae47bcafd391c4f0907da20246f601e8cf726aa03793f060bb60c828570a72921c402649cac760fd93253ef86d826f3f679b5ae5abfcc789a73280b151f6be
- SSDEEP 96:PUwpgzjF5lyW4UTyjtRRr29BkliMXEMsxjAP:PNpI5v4rtLr22LsxMP
- TLSH T1CDF164F1AAB227F0E24F772151D6624AF03A61E43B7705D8CC71F878503A76D1D36A98
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvum.dll
- IMPHASH bd000d299c7da6a138ba7d5df1127c3c
- SHA256 2b70754bd51130bd6534f87fd54088c535479ba250b569679f010bf9b5af8b36
- MD5 7c60d451d2b96a99f1ebcbe90a4167d0
- SHA1 6e59bf4b7e6e49fb23791abce44fb30e93568a73
- SHA512 fe1b2f51cd8e6afc66cfcef98f36d46534108e5dc5522285f8a1abfc83a214ffddee6665317267bca18441e3a60682e022e46623974303852cec616515ee3bb7
- SSDEEP 24576:dJr8MD8SbunKPIdn42KDmbszWfFWhZkdg1DSD:pDPbunKgdn4LDONdg
- TLSH T123258DA01647A2EED4424A7CCDFB7376C7BAA425C73582DFFB10669864113921DFA30B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
784236
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
w:\IntegratedDRV_WIN\Source\Component\ColorFB\Release\ColorFB64.pdb
kernel32
WriteFile
ReadFile
GlobalFree
OutputDebugStringA
GlobalUnlock
GlobalAlloc
GlobalHandle
GlobalLock
GetLastError
Sleep
CreateFileW
DeleteFileW
GetModuleFileNameA
GetModuleFileNameW
GetProcAddress
OutputDebugStringW
LoadLibraryA
WideCharToMultiByte
SetFilePointer
SetLastError
LoadLibraryExA
FormatMessageW
LocalFree
GetFileAttributesW
lstrlenW
GetLocalTime
GlobalMemoryStatus
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
GetFileSize
CreateFileA
FreeLibrary
CloseHandle
HeapFree
HeapAlloc
GetModuleHandleA
ExitProcess
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
RaiseException
GetStdHandle
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
MultiByteToWideChar
LCMapStringA
LCMapStringW
InitializeCriticalSection
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
user32
IntersectRect
winspool.drv
EndPagePrinter
ClosePrinter
StartDocPrinterW
StartPagePrinter
EndDocPrinter
WritePrinter
GetPrinterW
OpenPrinterW
DrvFBAbort
DrvFBEndDoc
DrvFBEndPage
DrvFBStartDoc
DrvFBStartPage
DrvFBUpdatePInfo
DrvFBWritePrinter
GetInfo1
Support64
Name
.text
Size
832KB
Virtual Size
829KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=126, version=50327,
count=59, id=110, productName=VS2005 build 50727, version=50727,
count=24, id=125, productName=VS2005 build 50727, version=50727,
count=156, id=109, productName=VS2005 build 50727, version=50727,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=126, id=1, productName=Unmarked objects,
count=92, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
itdrvum.xml
- SHA256 1f07325c4f47e62cb6f90332188de669b1d5b645424edea1ca39e3f0b7361bd2
- MD5 08c64a7eac9ef9241cd020498425f2f7
- SHA1 6796bb175ec60d9bf9a6ca6ea43e47331de89204
- SHA512 1fbbc949fab5f3a4fc1a229fd824fdec366917407e7306a69a8a7edfb303bac814885a9dfbceca3e91cff05eacb7541ed218ffebd8d37f3f94bbaaa0662f61a1
- SSDEEP 192:QW4zOlW0AStwEau46ZEau4wO1EpEm3ai9I1S1QyjBeS1ovGrlZ4NiUz+7:Qm/Q3vX54OrV
- TLSH T1E2B24952B76C35CB933BB00F99F46E101A3FFC16B61A966EB42575B3A30B4B13449CA4
- MD5 SHA1 SHA512 SSDEEP TLSH
itdrvuy.bmp
- SHA256 226145cc9b7866212109c0fd6b6572b46304ae4795000d6096e36890112342be
- MD5 de42d2fd908ee92ecab225a803feb5fa
- SHA1 7994b6523600c1bcebe51d3f068ab86e712bcc0a
- SHA512 c1452403f7a785648483a383a81fdc064fc5c9618d6250c55e7693f92e31549119338b9f92d5cc5175d5d97d7727176e4c4c6343f664bcdec3bb477ea64aa2a9
- SSDEEP 768:9eeeeeeeeeeeeeeeeeeeeeeeee22XxMe/Ek4/QW5BSYLd6fqFTWBCaFlCnMwIdNm:T2o/cYAyTWBdM
- TLSH T1A604C0A0D4376C312222E87CC590A94F86CB14E4FB42D66CF20CFE77756668129DFA76
- MD5 SHA1 SHA512 SSDEEP TLSH
sxp3m.PNF
- SHA256 9e4aab2a0c7ad7794d1a513d420a8e26bba9a4be2da06321340a6a5a5df67c31
- MD5 24aec972f0e5745fb5bdce8cce7cc72e
- SHA1 33fd985db2b319cd2ce4e1c6226316c43968a173
- SHA512 ddccf7bdb06d2c4eca085ccfeac4d61125df08c2fa81e953c14a9c75995d8fe8f6ac04f6d47da88831e8d33c2e2fc87df77be92d70e138753d47746d5f69233d
- SSDEEP 192:GZTwemZR4lp8cXTFimY2Db5DuiOPNnnkHP1NjbLtlna//72/z3jf/niu7RKpW+ux:GhwBZdeZiUHpkDEs4
- TLSH T1F04237037BDE8F09F56246706CE861E6947ABD52DF03DB5B6240330E1973B8897E2E19
- MD5 SHA1 SHA512 SSDEEP TLSH
sxp3m.cat
- SHA256 aaee3c4dde3fd2639b3f99c85f7a54a7605d96e59dc492878396508bd09fc1af
- MD5 59bfc34289dc19a9295a4ca72145033c
- SHA1 469352fb6fb0653d9449abda8d26f5491c9b30da
- SHA512 995d7808dba7312903c5fe5df01218198e94908a91c571bc41d99623f5953014f1a2f61315fba41ba459bd5ccf58bc136f5ef2ba7387225b642d2560356fd2d6
- SSDEEP 384:EeD/Vj8MuQx9Iciv/7BuVbYDiKSVnoqhU4/I3pUXtMFbhTSIVlMgCkCAgyV06BX4:7xVwfTBjZGn3V/
- TLSH T168D20F2E54DE03E2A15BC4B38BC6D46FF434DE5BE8045ABE31DB2B501A822517B4ED2D
- MD5 SHA1 SHA512 SSDEEP TLSH
sxp3m.inf
- SHA256 adfa2599f343684e44efdcf676681fc5014feb522fa7db1825ca31e86645cc7a
- MD5 fc050b436c44af7a6ac959b4dc1e0cc5
- SHA1 628e23f8db65fa2efd57139873f3d1503def3a90
- SHA512 ec0a0d3bff7d1b1472abdd14a5d3d0f55d191204baf239644de19708dce19bfa171664c15b3cc0f6c6287080bb2f71ec2ca0ad191887dfd81bc0458aeb094b8b
- SSDEEP 192:ubv4D7x9TyuPyfkNdaM9bfn+LdrYRVRKR1p:yv4DXFNdnfmtRF
- TLSH T166F1DE36DD02E9280323C7E5631147ADD897116E327585ACF05A84E877E2D49F36E37E
- MD5 SHA1 SHA512 SSDEEP TLSH
sxp3ml3.dll
- IMPHASH 37dd565cb3ed6918a8626d865c4866d3
- SHA256 de35e91e8d4e8e46673a1ea2b4bb614bff678ce4d9d5b76f065aa7ad5a8bb236
- MD5 c45a0a76dd1e22418be888c20c6d882a
- SHA1 f1c3657afda2621896c1775737cd4da06bd22789
- SHA512 801c453ac2664b1f275b7d4755eb22152d9e222fb14c929d62d606347a901d9bb40e8edd5fd6b721a1f5f435486052bbaf0d630739e6e24ffe46984fcc30ab36
- SSDEEP 384:5gYyQW4Zr/aCYlHoTj8z7bEXrdMHDSCSUQf9uWsh2/oAlOFmAf25XX8L8c:CYNXr/Y2Y7bEXrwDRSjf97shpPf25X2
- TLSH T189B2714063E99134F8F25AF05DBA51754A7BB8713B31C89E405086AEADB1B83CDB8377
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
17501
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\source\v1.47_2008r2_cluster_driver_install_issue\vista32\objfre_wlh_x86\i386\pjlmon2k.pdb
msvcrt
atol
_itoa
_ltoa
sprintf
wcsncpy
_wsplitpath
memcpy
memset
kernel32
DisableThreadLibraryCalls
SetUnhandledExceptionFilter
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
lstrcmpiW
GlobalFree
GlobalAlloc
CloseHandle
CreateEventW
GetLastError
FreeLibrary
GetModuleFileNameW
SetLastError
OutputDebugStringA
lstrlenW
lstrcpyW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetSystemDirectoryW
GetVersionExW
GetLocalTime
GetProcAddress
LoadLibraryW
UnhandledExceptionFilter
InitializeCriticalSection
lstrcmpW
Sleep
WinExec
TerminateProcess
GetCurrentProcess
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
user32
FindWindowW
wsprintfW
SendMessageW
spoolss
GetPrinterW
OpenPrinterW
EnumPortsW
ClosePrinter
SetJobW
ws2_32
gethostbyname
WSAStartup
inet_ntoa
WSACleanup
gethostname
DllEntryPoint
InitializePrintMonitor
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=58, id=1, productName=Unmarked objects,
count=13, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=5, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
sxp3ml3.smt
- SHA256 880c11846433af99b689eb2ed317e12183ca91e3915c68278c81ce26cb4b4d8b
- MD5 9398d1e400aa4cec2dde07f7f8af6cae
- SHA1 f0c378cd594bae34aa32bab4a0d7312f86979d33
- SHA512 a7fbb0da191c545c5114c14dbd4d2a20b7ba6294833534acb1db8bd05dbb567c49cbe12c2dc6c1e7546026e53106927fad12f13233faf752a755cc655fcda01d
- TLSH T138E0261A42B7BEDD98DA13003E3AFAC73C800014B382004A3577931CC428A8EF50F45D
- MD5 SHA1 SHA512 TLSH
sxp3mpp.ver
- SHA256 d001c047da7a51419e38e6aa2f2e7450bfbc3e01787969895aa6b53858af723e
- MD5 3246bea3349906fff4b04c685777b6eb
- SHA1 37d656e2d7f9910db64586fa85a61f5381ba83ce
- SHA512 7e2bed6b32f3bf0359f7fafbc9a402e10442dd7919fdfed3e797bf4d8ed21e24026567fb30359bf447fdec63f1ee46954015eee1b704adbcd02c954b71437bb0
- TLSH T16FE0684904082C79D4C3D74729D1464097F8CF8D72D6053C93297CDAA7C600CC379634
- MD5 SHA1 SHA512 TLSH
sxp3msc.cts
- SHA256 0ee11c6ac9c9863f041dbcc3358e2c090d2e8cd0e9df7ec7f0c75ed877213501
- MD5 9cb783214e001311cde0d349959bb869
- SHA1 f952b1cc6fef63657b971f0fdf22562548786cb8
- SHA512 a9d07c82c10e18c0016bb46f409ceabd2ae70627b05b9e0d1e5a94745f2014e714a514bc0fd60ccab8f21540a763c3b2202af288e5a1585db7e58d3ec6a3375c
- SSDEEP 768:L80t0NUH1BbtGl04q1+e+Y7DbpNCMxYPkOubpTndzEpKzBJKnzjOfb4Jn7OGS+jz:5/nCzubpTndsO+uw
- TLSH T14B4475F4E879AC9BF327D0397528F06896D95080F205D06F7426FA7852B3780296EF6D
- MD5 SHA1 SHA512 SSDEEP TLSH
sxp3mu.bmp
- SHA256 0865d77535a0bb4caeecd5de6d047727d45e50cad294a0ea8d5d381538171160
- MD5 6af77ac31c9eb375b0691693070c3153
- SHA1 87ce921f9bbc3d9353a41335758eef9b4e7b5189
- SHA512 3575864021217a6b4f2da6971e475fa478f441a4f078fe9943377ef024a9864368f2493398c1d5c73817d32590df1b84bcf7521713a02abe743198fb83b9328d
- SSDEEP 192:f7iuHhl2fS3SooQ7G2YIesI6GN5nLImRtgNZ1g1krKGBU4fY5ymC7t:f7iG+HWDwiN3q4fY5ymC7t
- TLSH T10BB2EF25662618EAD7F98FB068A66A0C2065AF431348461D2DD3F8DDDFBFC15108E9F3
- MD5 SHA1 SHA512 SSDEEP TLSH
sxp3mu.ini
- SHA256 6323a7c228bf7a32dc78a67d8f281c6452774325050cbe1566df97f7557725c4
- MD5 e8363e4d0ee8daa1eb8364039172cb42
- SHA1 62aff0a4c9b1ded33e01034c6c683ac3601b56d8
- SHA512 19b352202de66270eab1d4d19bd0e5f65cd6cc6dbb6a7bcb3ea5fddc6142ac5e5fc3d4ca9e0bffdd88e4e33ad2351df1b96d45fef54f3aeb0859e5431efaf668
- SSDEEP 96:nkQvk+QGqr4HBZ+YywyJa8HNn4LBIdpG5wa22uJHhcBc0Orxd:nFkH7Vn4FIAl5uEBc0Or3
- TLSH T1BBD156F3A2D70B4EC55A6699EE74064B31CBF4D324D6581F274A088E1CEAD37607E398
- MD5 SHA1 SHA512 SSDEEP TLSH